Masterclass: Web Application Pentesting

Module 1: Introduction to Web Penetration Testing

1. What is Penetration Testing
2. Cyber Kill Chain
3. MITRE ATT&CK Matrix
4. Testing methodologies
5. Reporting

Module 2: Reconnaissance

1. Open-Source Intelligence (OSINT)
2. Google hacking and alternative search engines
3. Subdomains and DNS enumeration
4. Discovering hidden secrets

Module 3: Introduction to Web Application testing

1. OWASP TOP 10
2. Role of local-proxy
3. Work automatization
4. Business logic issues
5. Supply chain attacks and vulnerable components
6. Chaining security issues
7. Information disclosures

Module 4: Browser's security mechanisms

1. Same Origin Policy
2. CORS and other exceptions
3. 3rd party cookies
4. Security headers
5. Content Security Policy (CSP)
6. Cookies’ and local storage security

Module 5: Cross Site Scripting

1. Reflected and Stored Cross Site Scripting
2. Attacking Document Object Model
3. Bypassing weak CSP

Module 6: Injections

1. Blacklisting vs whitelisting
2. SQL injections
3. Command injections
4. Other injection attacks

Module 7: Authentication and Authorization

1. Attacks on authentication and authorization
2. Attacks on sessions
3. Insecure Direct Object Reference (IDOR) attacks
4. Default credentials
5. JSON Web Tokens

Module 8: Insecure file handling

1. Path traversal
2. Content manipulation
3. Insecure file extensions

Module 9: Insecure inclusions

1. Local File Inclusion
2. Remote File Inclusion

Module 10: Testing API

1. OWASP Top 10 for API
2. Bypassing API access controls
3. Mass assignment attacks